afternoon everyone right onto the the
real final stretch for this afternoon
just one last reminder so at the end of
the at the conference the hotel is
arranged for an extra number of taxis to
be ready and wedding for all of those of
you that need to disappear off to the
airport and fly after after the
conferences completes now at this point
in time I'd like to introduce sushi
he'll be talking about the hacking team
and Gama international in business to
government malware over to you surgeon
well hello my name is Sergio Goliath and
I'm trying to set up my timer to be
right on time just give me a second okay
so my name is George Illawarra if I'm
the malware expert the Kaspersky Lab so
my job title means that I'm researcher
developer inventor and right now and
public speaker so you know that there
are several stories about the government
malware for example Germany in China but
I'm going to talk about particular about
the two cases and actually with the
hacking team and the Gama international
I think that some of you already know
the cases which I'm going to talk about
but just to just quickly remind you and
to make you feel how house bad to fight
with this kind of malware I want to show
you just one video you have new
challenges today
sensitive data is transmitted over
encrypted channels often the information
you want is not transmitted at all your
target may be outside your monitoring
domain is passive monitoring enough you
need more you want to look through your
targets eyes you have to hack your
target you have to hit many different
platforms
you have to overcome encryption and
capture relevant data being stealth and
untraceable
deployed all over your country exactly
what we do in control system Galileo
the hacking suite for governmental
interception
rely on us so this is gives you just an
example what we are going to talk about
and personname me this story started
with some letter that will receive 24 of
July the last year that percentage a lot
of security companies that contains the
chart fire with their Mac malware inside
it so right now we know that this case
was connected with the Moroccan case
where the journalist from Morocco was
attacked by this malware and of course
it was a lot of buzz because in the
media because he's in journalists and
it's really bad idea to attack the
journalists so he's the case and when I
talk about that political and you know
social questions about the lawful
interception we I cannot mention his
name his name is mr. Morgan here he
works for the Citizen lab and he working
in Google X security researcher so he
got you know skills he got knowledge and
you know he gets their source of
information so a lot of people are
trusting him and are sending him the
images of their laptops the samples and
he can you know directly access to the
victims who can share with him the
information
well I not have the sources so I started
to analyze this malware as well as
regularly doing with their you know with
the Zeus the Stuxnet and all those other
stuff so I started to analyze it like a
classic malware so the first of all I
needed there proves that this sample
this binary was really developed by the
hacking team but you know no but no law
enforcement will give me the computer
for the forensic analysis of the
developer love hiking team so I need
some evidence so the evidence was like
so the first one was obvious in all
materials of the hacking team they're
using their RSS I got letters to
describe their functionality then we've
got the same functionality in the same
latest in the binaries then it was the
export which is part this is available
on the virus topple that then also
payloads from the hacking team subdomain
and the last one that
in the Sun version of the Trojan the
path where the source quartz was located
was in the name for the username greed
and suddenly guida is the name of the
senior developer at the hacking team so
well you know I don't have the you know
proofs for the course that this malware
was developed by hacking team but as a
searcher this information is really
enough for me so what can I do so we
started to analyzes the functions of the
samples and we need you know information
from the published sources and no big
leaks there are some documents about the
functions and how the hacking team is
propagating my wiring I was describing
and the same functions were located in
the binary so screenshots in record
audio making the video from the victims
computer and so on but you know the
actually the were several other
interesting things that wouldn't
describe for first of all it was this
there was a self replication mechanism
so for example in Russia if the judge
gives the law enforcement you know right
to spy for someone judge will never
never never allow the law enforcement to
for example monitor all the you know
random people and the friends of the of
the suspects but malware you know allows
law enforcement to you know replicates
and in fact any computer with this flash
drive then it's got the infection of
virtual machines it can work with the
mobile platforms then is got the built
to set up date installation drivers and
usually the samples are sign it my my
you know authorities so now the the
fourth and the fifth
you know layer is really really
important because the worst scenario of
using the law enforcement tool is the
case when the law enforcement the
officer for example in some country it's
possibility can install the malware
inside the machine then updated this
malware with additional code and this
additional code will download some
forbidden content from the internet like
a child porn on the computer and then
this code will be you know self deleted
after that law enforcement scan clock
the door and said like yeah guilty and
the guy will have no no no nothing to do
with it because there will be no
evidence that the malware was existing
on his computer so the other way is the
how it's propagating we got the several
documents and described the physical
access then we have the remote methods
for installation social social
engineering the self update like
subsonic jars like in Moroccan case then
we learned that were lots of for example
attachments with the file name flesh of
data to see and then we started to see
the exploits well I was you know
searching in our antivirus collection
for their samples that was actually used
to install the smell way and you know
for example the the idea was that for
example this sample was detected in June
and the vulnerability was the scored in
September so I could just compare with
this date and I see that for example
whooping was like the most actually
publisher of the exploits and the last
one was described discovered by me so
wise was lovely lucky I passed this zero
data Adobe unfortunately I don't be
right now have more interesting stuff to
deal with but anyway there's the zero
that was discovered and this zero day
was you know mentioned now the be case
it's with was the case when this
exploits and this malware was founded in
the US but the C&C server was located in
other country and you know this is a
real big problem for the you know
international cooperation between law
enforcement because it's not allowed for
example the FBI to to monitor citizens
in Russia and the same time before the
fees be you know we got no power in the
US so the you know the malware is cross
boarded and here's the an example of how
they smell a can act the other borders
and so the the name of the slightest
Frisby spy or is it the hacking team
malware well I don't know guys who
decided to call this malware FSB because
the if is being you know got no
connection with the hacking team and we
had a lot of fight between the
researchers who was analyzing the
samples to prove that the FSB spy is the
just a code reuse of Arceus malware so
if we talk about the countries let's
like see the map so well we didn't make
this special
you know detection for the hacking team
malware because we get a lot of
automation system that detecting a lot
of malware and this automatic system
really do not care about the source of
the malware so I just collect the old
verdict and place it on the map and the
map we see the Mexico is the most
infected country by this malware and
please remember this country I will
describe it the cases in future but if
you need you know the more accurate data
not from the Kaspersky Lab you maybe you
should use this data the fingerprint so
the citizen lab Morgan have discovered
the c2 fingerprint for searching the
servers of the finfisher so I've died
the same so he is the request so this is
like specific names of the files and you
will ask some web server about this
dislocation of this files then the ants
were of the scene sister will be like
this so air or air charge collector or
any key is there you know offset in the
binary where it was generated roar in
fact this is where I'm stopping my
researching me guess you know mr. Ross
and yesterday on the Symantec
presentation how there was in hauling
really good jobs in holding the zero
access it's a huge success but you know
I don't want to think all these botnets
because you know if I'll try to do this
then I will you know immediately to get
charges for the Block in the judgment
and he is that the technical information
that could be publicly available but no
for the steps and well of course I'm
continuing my research you can trying to
fight another zero days that should be
used
the explanation of abilities to install
this kind of malware but you know no
active research right now about the
hockey team the other story
this is story about the finisher well
this is much more sophisticated malware
than hacking team and for example if you
know some techniques that can be used to
prove you know to block the researcher
to avoid the detection then this
technique is available in the contrition
my way it's a boot kit is it's
virtualized it's a post kata several
layers of encryption so it took me about
the one month to you see you know to
look at the exactly clean binary and and
it asked my colleagues to help me with
that because it's too much job to do but
but at the end we were you know clean
their will clean all the stuff and
cynical so what is it about well the
first of all the methods of propagation
so there were a lot of documents about
the finfisher on the Vic Alex and I
describing the physical access and
physical by way of installation of this
malware at the same time would discover
the social engineering techniques for
in-store installation and one one and
one was really you know funny because I
saw that that malware was detected on
some you know web sites in the name and
the file name of the malware was the
flash update that X Z so when of course
I go to this website and it's close
nothing over there but you know it's
really hard to hide in the Internet so
the main tools screenshot make it
screenshot of this domain when it was
actually propagating the finfisher
and you know this is domain so I see the
content of the site and this is a
phishing site of the news media and in
some country let's say so the guys who
was stalling this software was used as
social techniques and yes
no exports at all I couldn't find
anything zero then not zero day
everything is clean so
maybe you will find it then I will you
know shake your hand but I had black
again functions the list of the
functions you completely know almost the
same as they were hacking team we're
also forensic job but you know the most
interesting part was the list of the
applications that can be used to you
know get the passwords get the emails
and so on and maybe some of you don't
know but if in some malware you've got
the Opera browser you've got the bad
email client client must execute
messenger and to speak then that means
that only one country let's say an
exersaucer country this for software got
really popular that's why when we
received this map you know we wasn't
surprised but I am from Moscow from
Russia and I was surprised because for
example the first presentation and
really said that in Russia we got the
big system called Seoul for monitoring
all activity on the Internet and the
telephones and so on and you know
there's really no need to install the
kind of tools so we had the three main
theories first of all some police
department bought this two second theory
this is their correct versions of this
too because we and with the finfisher
and we're hiking team we got you know
some samples that looks like cracked and
the third theory that some are the
government are spying on the russian
citizen so we started to look at the
truth and the truth was you know
completely different so all this
detection what we see in this map from
robots
you know this cyber and growl russians
and underground are providing no several
services to other cyber criminals like
affiliate networks for checking
detections it's like very subtle
actually but for the underground using
so and all
victims which is located in Russia
running the virtual machines only they
are using travel issues of Avis and they
detected several ten thousands malware a
day so this is Robert but let's back to
the Mexico the story there was that the
US authorities was catching the narco
boss in the sea they took the boat where
was a several the several kilograms of
kana cortex by using the spyware and
this you know it brings us the good news
because if mr. Morgan is telling that a
lot of cases connected with the fight
again the human rights activist
pro-democratic activist but this case
you know is like making balance between
the good ways of using the malware and
the bad ways and actually you know this
is really ridiculous
in fact because the malware saves life
that's it so how can they do with it
okay so once again what you can do in
what that's what I was looking when I
was was looking when I was looking in
the coat the Western era with the hockey
team you know ability to execute their
any code I was trying to find this
functional in the efficient and I didn't
found it so the protocol you know
make conversation with the c2 server is
using the up codes and it is really hard
you know to know when he got the binary
code it's really hard to analyze it but
I've done everything but I can but I
didn't find this up codes and the le
possibilities acute codes but the
think Fisher developers got you know
challenge they've got the malware for
for all available fur performs popular
Windows Mac and Android and we have
their malware from the free picture for
the Android and you know that the aedra
malware is much more easier for
researching and its side of this jar
file apk files there was a class that
was fully described fully described they
all functions are up course with malware
can you know say to the c2 server and
what si tu savais can answer and inside
of this config file inside of this
malware the war the up chords for
executable files for making the remove
shell comments allowed to execute
anything you want so that means then
malware can fish'
can execute the anything but we don't
have a sample so right now the theory is
that somewhere exists the premium
version of the finfisher
that can do anything but we got no
samples well summary it's a focus to get
my wallet
malware and how I learned this well if
it took several months it's a
sophisticated no we're trying to avoid
detection
working with their drivers several ways
of you know bypass the hips policies by
several methods of injection decodes in
the several processes they use the
really hard associated techniques in so
on they've got the freeways of
installations there we see the several
hundred infection we are our cloud
solutions and what we should do
well mr. Andrew Lee and his first
presentation was asking us the questions
so you know I I didn't have the right
answers but you know I cannot recommend
you anything because but I think it
could be
nice if the law enforcement will not use
the remote methods of installation
dismembered only by physical access no
way exploits no social tricks no access
through the ESPYs just a physical access
and during this physical access the law
enforcement can you know use the DRM
technologies so the mailman couldn't be
you know copied to another computer and
then while the physical access please
remove the a/v that's it you know I'm
really you know I can explain customers
why the software didn't help him to deal
with my way because we you know with
software you know you can walk you can
work without the hard way so that's it
and then you know I understand that for
law enforcement it's really you know
hard trick because they need you know
making they can know do know the
location of the suspect so maybe they
should build a big big monitoring system
which wouldn't read the whole content
what all citizens reading of writing but
just you know click the sources that for
example this email was send it from this
IP address and the PD address located
over here and then by physical access
they can delete every install the
malware and that's it but once again
it's my opinion only well
in fact this is the end of my
presentation my research but you know it
is a really nice conference I really
like the presentation so I won't think
thank you all friend presented
organization team all participants so I
can I can't you know allow me to end
this presentation with such you know you
know many thoughts negative way what we
should do and so on so I'd like to
entertain you and tell you my story
about my feelings during this research I
was really down because they smell well
you know I have they some ethics and
brains so my brains taught me to do
several things but we can do with the
cybercriminals games and I was really
down and when I wrote the stories from
the Morgan about how this Melville was
used it was terrible so it was a
nightmare for me
I didn't slept smoke drink a lot of
alcohol my wife asked me to you know to
eat something so it was a nightmare but
then my friend sent me some link to the
British comedian it was really funny so
I decided to no to deal with my feelings
and to do something to back to the
normal life so I decided to write a song
and the song is about the malware the
law-enforcement the AVS about everything
about all my feelings enjoy
for junga the heater and malware created
for life
I think I'll never ever get you relieved
but today they come to visit
the time let's go I think I do
irony Walter
to reversing bias to moving you next
time on your ministry you will be
arrested and put in jail
something wrong
the two response because on the
grapevines can imagine
stays out reasoning and friendship from
your carpets clients so maybe you should
create a job like you better act like
yourself you crazy
the kitchen the bar
thank you questions thanks EJ yeah he's
gonna follow that up if they're in a
singsong voice for a question come on
who's next any questions out there one
question just in here here comes the mic
hello representation just out of
curiosity
f-secure among couple other players have
made the proclamation that we will
detect all marver no matter from which
police even in finish do you know what's
the Kaspersky's official standing stands
on this can you please repeat the
question so thanks so basically what we
do is that we have made a claim that we
will detect all malware no matter who is
using it yeah yep so well you know we
got the big big automatic systems and we
really you know the robots do you know
anything about the hacking team and this
song so actually you know we hadn't you
know right
you know orders to stop blocking it we
don't have them maybe they're an
official way some law enforcement are
coming to us during some conference and
asking you know maybe we should allow
them it's a blue case it's a really big
case so we're saving lives so maybe we
should like but we said okay so well
good but I can you know fight with
infrastructure so this is like the roof
so this is the way how we didn't put it
so we are working we are doing what job
and what what else what do you need from
us good aspect Thanks so with that we
wrap up today's session of if you don't
like to raising hands one more time for
the surgery for his excellent
presentation
you